input {
  {{ item.protocol }} {
    port => {{ item.port }}
    tags => ["nginx-json"]
  }
}

filter {
  if "nginx-json" in[tags]{
    json {
      source =>"message"
      remove_field => ["message"]
    }
    geoip {
      source => "remote_addr"
      target => "geoip"
      database => "/etc/logstash/GeoLite2-City.mmdb"
    }
    fingerprint {
      target => "[@metadata][uuid]"
      method => "UUID"
    }
  }
}

output {
  if "nginx-json" in[tags]{
    elasticsearch {
      hosts => ['{{ opendistro_servers | list | join(":" + opendistro_port.rest + "', '") }}:{{ opendistro_port.rest }}']
      ssl_certificate_verification => false
      ssl => true
      ilm_enabled => false
      user => "logstash"
      password => "{{ lookup("password", "" + group_names[0] + ":logstash length=12 chars=ascii_letters,digits") }}"
      index => "logstash-nginx-json-%{+YYYY.MM.dd}"
      template => "/etc/logstash/template/logstash-nginx-json-template.json"
      template_name => "logstash-nginx-json"
      template_overwrite => true
      document_id => "%{[@metadata][uuid]}"
    }
  }
}
